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What is claimed: 

1 . A device for managing network traffic flow, the device comprising: 
a processor, the processor configured to 

5 receive network traffic content, 

determine whether a protocol of the network traffic content matches 
a prescribed protocol of network traffic content that could contain content 
desired to be detected, and 

store the network traffic content in a stack when the protocol of the 
10 network traffic content matches the prescribed protocol. 

2. The device of claim 1 , wherein the processor comprises a general 
purpose processor. 

15 3. The device of claim 1 , wherein the special purpose processor comprises 
an ASIC processor. 

4. The device of claim 3, wherein the ASIC processor is a semi-custom ASIC 
processor. 

20 

5. The device of claim 3, wherein the ASIC processor is a programmable 
ASIC processor. 
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6. The device of claim 1 , wherein the processor is further configured to send 
the network traffic content to a user when the protocol of the network traffic 
content does not match the prescribed protocol. 

7. The device of claim 1 , further comprising the stack. 

8. The device of claim 7, wherein the stack is implemented in the processor 
or in another processor. 

9. The device of claim 8, wherein the stack is configured to store network 
traffic content in accordance with the protocol of the network traffic content. 

1 0. The device of claim 1 , further comprising a memory; 
wherein the processor is further configured to 

send at least a portion of the network traffic content to the memory 
when the protocol of the network traffic content matches the prescribed 
protocol, 

send a copy of the network traffic content to a module, the module 
configured to determine whether the network traffic content contains 
content desired to be detected, and 
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assemble the at least a portion of the network traffic content with 

the rest of the network traffic content, and transmit the network traffic 

content to a user when it is determined that the network traffic content 

does not contain the content desired to be detected. 

1 1 . The device of claim 1 0, further comprising the module. 

12. The device of claim 1 1 , wherein the module is implemented in the 
processor. 

13. The device of claim 1 1 , wherein the module is implemented in an ASIC 
processor. 

14. The device of claim 1 , further comprising a memory; 
wherein the processor is further configured to 

flag the network traffic content when the protocol of the network 

traffic content matches the prescribed protocol, 

send the flagged network traffic content to the memory, 

send a copy of the network traffic content to a module, the module 

configured to determine whether the network traffic content contain 

content desired to be detected, and 
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transmit the network traffic content to a user when it is determined 

that the network traffic content does not contain the content desired to be 

detected. 

5 15. The device of claim 14, further comprising the module. 

16. The device of claim 15, wherein the module is implemented in the 
processor. 

10 1 7. The device of claim 1 5, wherein the module is implemented in an ASIC 
processor. 

18. The device of claim 1 , wherein the content desired to be detected is 
selected from the group consisting of a virus, a worm, a web content, a Trojan 

15 agent, an email spam, and a packet transmitted by a hacker. 

19. A method for managing network traffic flow, the method comprising: 
receiving network traffic content; 

determining whether a protocol of the network traffic content matches with 
20 a prescribed protocol of network traffic content that could contain content desired 
to be detected; and . 

58 

PA:521 13640.1/3000683-7035332001 



PATENT 
3000683-7035332001 

storing the network traffic content in a stack when the protocol of the 

network traffic content matches the prescribed protocol. 

20. The method of claim 19, wherein the network traffic content is stored in 
the stack in accordance with the protocol of the network traffic content. 

21 . The method of claim 1 9, further comprising: 

sending at least a portion of the network traffic content to a memory when 
the protocol of the network traffic content matches the prescribed protocol; 

sending a copy of the network traffic content to a module, the module 
configured to determine whether the network traffic content contain content 
desired to be detected, and 

assembling the at least a portion of the network traffic content with the rest 
of the network traffic content, and sending the network traffic content to a user 
when it is determined that the network traffic content does not contain the content 
desired to be detected. 

22. The method of claim 19, further comprising: 

flagging the network traffic content when the protocol of the network traffic 
content matches the prescribed protocol; 

storing the flagged network traffic content in a memory; 
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sending a copy of the network traffic content to a module, the module 
configured to determine whether the network traffic content contain content 
desired to be detected, and 

transmitting the network traffic content to a user when it is determined that 
the network traffic content does not contain the content desired to be detected. 

23. A device for managing network traffic flow, the device comprising: 
a first processor, the first processor configured to 

receive network traffic content. 

send at least a portion of the network traffic content to a memory, 

and 

send a copy of the network traffic content to a second processor, 
the second processor configured to determine whether the network traffic 
content contains content desired to be detected. 

24. The device of claim 23, wherein the first processor is further configured to 
assemble the at least a portion of the network traffic content with the rest of the 
network traffic content, and cause the network traffic content to be transmitted to 
a user when it is determined that the network traffic content does not contain the 
content desired to be detected. 

25. A method for managing network traffic flow, the method comprising: 
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receiving network traffic content; 

storing at least a portion of the hetworl< traffic content to a memory; and 
sending a copy of the networl^ traffic content to a processor, the processor 

configured to determine whether the networic traffic content contains content 

desired to be detected. 

26. The method of claim 25, further comprising assembling the at least a 
portion of the network traffic content with the rest of the network traffic content, 
and transmitting the network traffic content to a user when it is determined that 
the network traffic content does not contain the content desired to be detected. 

27. A device for managing network traffic flow, the device comprising: 
a first processor, the first processor configured to 

receive network traffic content, 
flag the network traffic content, 

send the flagged network traffic content to a module, the module 
configured to pass unflagged data to a user and prevent flagged data from 
being sent to the user, and 

send a copy of the network traffic content to a second processor, 
the second processor configured to determine whether the network traffic 
content contains content desired to be detected. 
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28. The device of claim 27, wherein the first processor is further configured to 
transmit the network traffic content to a user when it is determined that the 
networl< traffic content does not contain the content desired to be detected. 

29. The device of claim 27, wherein the module comprises a memory, a 
buffer, or at least a portion of a processor. 

30. A method for managing network traffic flow, the method comprising: 
receiving network traffic content; 

flagging the network traffic content; 

sending the flagged network traffic content to a module, the module 
configured to pass unflagged data to a user and prevent flagged data from being 
sent to the user; and 

sending a copy of the network traffic content to a processor, the processor 
configured to determine whether the network traffic content contains content 
desired to be detected. 

31 . The method of claim 30, further comprising transmitting the network traffic 
content to a user when it is determined that the network traffic content does not 
contain the content desired to be detected. 
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